The url for routes are misnamed and confused.
/workspaces (GET, POST)
/workspaces/<wid> (GET, DELETE, PATCH)
/workspaces/<wid>/groups (POST, GET)
/workspaces/<wid>/groups/<gid> (GET, DELETE, PATCH)
/workspaces/<wid>/groups/<gid>/users (POST, GET)
/workspaces/<wid>/groups/<gid>/users/<uid> (DELETE)
/users (GET, POST)
/users/<uid> (GET, DELETE, PATCH, PUT)
The url for routes are misnamed and confused.
Here is an example of a better way :